Threats tagged 'bit-tomcat-2026-74048'

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Medium	–	EPSS 0.2%	CVE-2026-74048Apache Tomcat · OpenSSL-FFM FIPS failure does not prevent start-up MediumEPSS 0.2%2026-10-29GCVE DatabaseCVE-2026-74048 Apache Tomcat versions 9.0.92 through 9.0.122, 10.1.22 through 10.1.60, and 11.0.0 through 11.0.26 contain a vulnerability where the OpenSSLLifecycleListener fails to enforce FIPS mode securely. If FIPS activation fails, Tomcat logs an error but continues running using JSSE in non-FIPS mode with the provided configuration. This behavior is a 'Failing Open' security issue. Fixed versions are 9.0.123, 10.1.61, and 11.0.27. EPSS 0.2%Report on CVE-2026-74048 Vulnerability #bit-tomcat-2026-74048 #bitnami	GCVE Database	2026-10-29

Page 1 of 1